hxxps://onlinehr[.]net/663cc49f08d0e/token/406dcbdee75cf8a65196c91981729a1732bebed2/

Analysis

max time kernel
300s
max time network
249s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://onlinehr.net/663cc49f08d0e/token/406dcbdee75cf8a65196c91981729a1732bebed2/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597584883419880"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
5032	chrome.exe
5032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2896	3448	chrome.exe	82
PID 3448 wrote to memory of 2896	3448	chrome.exe	82
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 4236	3448	chrome.exe	83
PID 3448 wrote to memory of 368	3448	chrome.exe	84
PID 3448 wrote to memory of 368	3448	chrome.exe	84
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85
PID 3448 wrote to memory of 748	3448	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onlinehr.net/663cc49f08d0e/token/406dcbdee75cf8a65196c91981729a1732bebed2/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5fe9ab58,0x7ffa5fe9ab68,0x7ffa5fe9ab78
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:8
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2500 --field-trial-handle=1888,i,14022887462085259444,1688554172430898461,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
702ce3f47eef561b518a481fe03aff7e

SHA1
1dce1b262884e66e18ef3a429f906b31dc2fef35

SHA256
793a9ff50cc05c9dbe85ac1cd6b062f6fdf4dd7eba5811e6ca909c973c56673f

SHA512
b6ba10dc6ca0fb4a5393133ac6e3334cee8d1112fcd73370c152eb8381b1c0fd555d5dcfbc323b8627ebae4edc1e40e26573a1b502061d8a5603a3124d1ca175

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
caca43498378fe6913b3d262f874f3b4

SHA1
6a6145131364e44ab434115e1888d405b85cb459

SHA256
7e5350df7d23c7e0b172b1e9b0d3c113d902c3940e9ef41e06cfc094102cbf4c

SHA512
2369df9f4cabadba7f98c6eb1a1e36f99b28cead82377a992e757c6718856578ae986bef08f4140d62e3a6514dce1f61b55c27bfd7163cf17af959f915463afa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
cf7ebc326b84f50a9da64612f5cb69c2

SHA1
0b75adcd300b012c410a0c64fa7efb464f18fcfe

SHA256
48d2ad8d5ff55709aaaf2a057e2d6247d9171d018ae48e7c5f5c72c44eccd718

SHA512
0071c2d044ee20e0f584d85c514d7d66772e1fd546384d60c59408e75d844e513b0407726bf74f142173b67150abe05ab025cfa5539efc00eb146381dfa9b9c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
468d5a097e938e7fc1318c93618d3c52

SHA1
546f16059eab0986a5a9e0315c445a1c3b9f6564

SHA256
32a9067c0e63f046ee1734537f4476c2f126828746ac6b018bac8193f90b0894

SHA512
f5c61e3a1980a01f670d5596562b3eaefc3ac0025b36ae5ae5d19c840691d81e5cce6160c5070acf1663e70542dd2db40d530b075f3212143e01bd8145162fed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
e9f758be9fb8c15b0f497e4c3102cf6c

SHA1
eeff79f2b5c1db3c64665a0f3851db62d48eb8e5

SHA256
9bfd0550fb0d4f23839503b5a1be63abe4a8603b2d3871e2b3a59d73974cb4cd

SHA512
822ba4131a9ae87742a6cdb850a6d00b53fda1db5f92d2281fa30e787cb32af80b1eac731cabd84a736bd8e0aed097a30b2d3791214c7e4482f8ce1b49354e04

Download Submit